CERT24MAL-2026-17192 — Malicious code in donutautosellsrc (PyPI)Loading data…
CERT24Threat Observatory
Period

MAL-2026-17192 — Malicious code in donutautosellsrc (PyPI)

Code in the donutautosellsrc package automatically executes during installation or PEP 517 wheel building and downloads a ZIP archive hidden after PNG data. The archive contains a Python application with a native extension and an obfuscated infostealer that collects sensitive data and exfiltrates it to a C2 server retrieved from transaction history on the Polygon blockchain.

← Back to intelligence

MAL-2026-17192 — Malicious code in donutautosellsrc (PyPI)

Code in the donutautosellsrc package automatically executes during installation or PEP 517 wheel building and downloads a ZIP archive hidden after PNG data. The archive contains a Python application with a native extension and an obfuscated infostealer that collects sensitive data and exfiltrates it to a C2 server retrieved from transaction history on the Polygon blockchain.